Notification handbook
Section 1
Commonly asked questions and answers
1.1 What is notification?
The Information Commissioner’s Office maintains a public register of data controllers. Each register entry includes the name and address of the data controller and a general description of the processing of personal information by a data controller. Individuals can consult the register to find out what processing of personal information is being carried out by a particular data controller. Notification is the process by which a data controller’s details are added to the register.
1.2 Why do I need to notify?
The Data Protection Act 1998 (DPA) requires every data controller who is processing personal information in an automated form to notify, unless they are exempt. Failure to notify is a criminal offence.
1.3 How can I find out if I am exempt?
We have produced a self-assessment guide to notification exemptions. It can be found in Section 6.1 of this handbook and is also available as a separate publication.
1.4 Do I have to notify my manual records that come within the scope of the Act?
No, but you can choose to notify them voluntarily. Further information about manual records can be found in our publication ‘Data protection legal guidance’.
1.5 How do I notify?
There are three easy ways to notify:
- On the internet (ICO Notification page). You can complete the notification form online, print it out and send it to us with the notification fee or your direct debit instruction.
- By completing the ‘Request for a notification form’ (see Section 6.4). This should be faxed or posted to us marked for the attention of the Notification Department (Notification requests). Alternatively, the information can be emailed to us. A draft notification form will then be sent to you for further action.
- By telephone. You can telephone the notification helpline and a draft notification form will be sent to you based on the information that you will be asked to provide on the telephone. Our contact details can be found on the ICO Notification page.
1.6 Why have I been sent a draft description of my processing of personal information?
This only happens when someone has asked for a notification form. Data controllers have to describe their processing of personal information. To help them, we have put together draft processing descriptions for different types of businesses. The descriptions include the purposes, associated data subjects, classes and recipients most likely to be appropriate to a particular business.
1.7 What do I do if the draft processing description is incorrect or incomplete?
The final page of the Part 1 form explains how to amend the draft details, this information is also included in Section 3 of this handbook.
1.8 What is the fee for notification?
The fee is £35 (VAT nil). Any change to this fee will be advised to you when you start the process of notification. You can pay by direct debit, cheque or BACS. We do not send invoices. For more information about fees, see Section 3.2.6.
1.9 Do I have to renew my notification?
Yes. The notification period is one year, and the renewal fee is £35. We will tell you of any change to this fee when you start the process of renewal. We will write to you before the expiry date of your register entry. Payment by direct debit is an easy way to ensure that your registration is renewed on time each year. If you are required to notify but fail to renew your registration, you are committing a criminal offence.
1.10 What do I do if there is a change to some part of my register entry during the one-year notification period?
You must write to tell us about any changes as soon as possible and in any event within 28 days. Failure to keep a register entry up to date is a criminal offence.
1.11 Can I have more than one register entry?
No. A data controller may only notify once. However, provision can be made for trading names to be included in the register (see Section 3.2.2).
1.12 How can I find out the meaning of some of the terms used in this handbook?
Section 5 contains a glossary of terms.